Abstract:Automatic speaker verification (ASV) systems have been widely applied in voice user interfaces to conduct person identification and access control via voiceprints. A typical ASV system consists of three stages, i.e., training, enrollment, and verification. Previous work has revealed that the ASV system can be bypassed at the training stage by backdoor attacks and at the verification stage by adversarial example attacks. In this paper, we propose a new type of backdoor attack aimed at the enrollment stage via adversarial ultrasound, named UltraBD, which is highly imperceptible, synchronization-free, and content-independent. By simultaneously injecting the ultrasound backdoor examples when the legitimate user initiates the enrollment, the polluted voiceprints stored in the ASV systems grant access to both the legitimate user and the adversary with relatively high confidence. Despite the challenges, i.e., when, what, and how the legitimate user articulates at the enrollment stage can be remarkably unpredictable and various, we managed to launch UltraBD by augmenting the generation and optimization process of the ultrasound backdoor examples with the randomness of synchronous time and relative amplitude ratio. Furthermore, we optimize the modulation mechanism of adversarial ultrasound by tuning the baseband signal on limited signal frequency points to improve its robustness in the physical world setting. We validate UltraBD on two common datasets together with two open-source ASV models. Results show that UltraBD can be robust to various configurations, e.g., different speakers and utterance content. In sum, our attack calls attention to a new attack surface of ASV systems and sheds light on its fundamental mechanisms.

UniAP: Protecting Speech Privacy with Non-Targeted Universal Adversarial Perturbations

Echo: Reverberation-based Fast Black-Box Adversarial Attacks on Intelligent Audio Systems.

The Silent Manipulator: A Practical and Inaudible Backdoor Attack against Speech Recognition Systems

UltraBD: Backdoor Attack against Automatic Speaker Verification Systems via Adversarial Ultrasound

Adversarial Perturbation Prediction for Real-Time Protection of Speech Privacy

On the Generation and Removal of Speaker Adversarial Perturbation for Voice-Privacy Protection

Universal Adversarial Perturbations for Speech Recognition Systems

Adversarial speech for voice privacy protection from Personalized Speech generation

Universal Adversarial Perturbations Generative Network for Speaker Recognition

Inaudible Adversarial Perturbation: Manipulating the Recognition of User Speech in Real Time

IUAC: Inaudible Universal Adversarial Attacks Against Smart Speakers

Transferable universal adversarial perturbations against speaker recognition systems

Adversarial Privacy Protection on Speech Enhancement

Implement of a Secure Selective Ultrasonic Microphone Jammer

Phoneme-Based Proactive Anti-Eavesdropping with Controlled Recording Privilege

Privacy-preserving and Privacy-attacking Approaches for Speech and Audio -- A Survey

Attack on Practical Speaker Verification System Using Universal Adversarial Perturbations

Query-Efficient Adversarial Attack with Low Perturbation Against End-to-End Speech Recognition Systems

Privacy-Utility Balanced Voice De-Identification Using Adversarial Examples

Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognition

Privacy against Real-Time Speech Emotion Detection via Acoustic Adversarial Evasion of Machine Learning